Qilin Ransomware Decryption & Data Recovery

Qilin first appeared in July 2022 as Agenda, written in Go. It rebranded to Qilin in September 2022 and was fully rewritten in Rust, gaining cross-platform reach, faster encryption and better static-detection evasion. Trend Micro tracks the operators as Water Galura. In October 2024, Halcyon documented the upgraded Qilin.B variant: AES-256-CTR with hardware acceleration, ChaCha20 fallback and RSA-4096/OAEP, plus new anti-forensic behaviour — deleting backup-related services, wiping volume shadow copies, clearing Windows event logs and self-deleting after encryption.

Scale is Qilin's defining characteristic today. After RansomHub's infrastructure went offline in April 2025, a large share of its affiliates migrated to Qilin and leak-site postings roughly doubled. Multiple quarterly trackers place Qilin as the most prolific ransomware operation worldwide for several consecutive quarters from 2025 onward; in the first half of 2026, Cyble and The Cyber Express ranked it first globally by attack volume, with a year-over-year increase above 400% and close to 280 leak-site victims in a single quarter. MOXFIVE puts cumulative claimed victims at roughly 1,500 since launch.

China relevance is concrete. Asia-Pacific volume sits below North America and Western Europe, but during 2025–2026 Taiwanese electronics and interconnect manufacturers (including contract and interconnect-product makers) and a Hong Kong-listed manufacturer have been posted to Qilin's leak site. What these victims share is exactly the structure Qilin attacks best: heavy ESXi virtualisation hosting MES and ERP, leased-line interconnects between plants, and many VPN accounts with incomplete MFA coverage.

By sector, Qilin spans manufacturing, healthcare, logistics and transport, professional services and the public sector, hitting both SMEs and large groups. Its 2025 attack on a major Japanese beverage producer halted production at dozens of plants — a clear illustration of one encryption event stopping an entire production chain.

Extensions. Qilin uses no fixed extension. Most builds append a per-victim company ID or random string to the original filename; some use .qilin. Extension alone cannot confirm the family — the note and file-tail structure are required.

Ransom note. The filename takes the form README-RECOVER-[random string].txt, where the random string matches the file extension — one of the most reliable Qilin indicators. Note content is customised per victim by the affiliate and typically names the organisation, threatens publication and supplies a Tor negotiation entry point.

Host-side artefacts.

• Security services, databases and Veeam/backup agents stopped en masse; Windows event logs cleared.
• Qilin.B deletes backup-related services and self-deletes after encryption, leaving fewer artefacts than comparable families.
• BYOVD (bring-your-own-vulnerable-driver) has been observed to disable EDR.
• Browser credential theft: saved usernames and passwords bulk-exported from Chrome and others for lateral movement.
• Some cases modify the registry to auto-logon in Safe Mode and reboot, bypassing running protection software.

Virtualisation artefacts. On ESXi/vCenter: guests powered off en masse, snapshots deleted, ransom notes under /vmfs/volumes, with encryption focused on vmdk, vmem and vswp files. The same encryptor also runs on Linux and FreeBSD.

Qilin's affiliate base is large and mixed — many arrived from RansomHub and other dissolved operations — so tradecraft varies, but the main lines are consistent.

1. Edge device and remote-access flaws. Internet-facing VPN, firewall, file-transfer and remote-support products are the primary entry point, especially unpatched Fortinet, Citrix and SonicWall-class devices and SSL VPN accounts without MFA.

2. Phishing and credentials. Targeted phishing with attachments or links delivers initial payloads, alongside heavy use of brute force, credential stuffing and ready-made accounts bought from initial access brokers.

3. Browser and credential-store harvesting. Once inside, Qilin shows a marked preference for pulling operations credentials from browser-saved passwords, going straight to vCenter, backup consoles and network management systems.

4. Pivot into the virtualisation layer. With domain admin or vCenter rights, operators push via vCenter or SSH directly into ESXi, powering off guests, deleting snapshots and encrypting VMDKs — one action takes every business system offline at once.

5. Exfiltration before double extortion. Data is staged and shipped out with Rclone, cloud-storage clients and SFTP before encryption, then used for leak-site pressure. Qilin additionally offers affiliates negotiation support and media-pressure services, making its coercion more systematic than most peers.

Deployment is usually timed for holidays or the small hours, launched simultaneously across hundreds of hosts via Group Policy, PsExec or scheduled tasks to compress the defender's response window.

Algorithms. Qilin.B uses AES-256-CTR with hardware acceleration where AES-NI is available, falling back to ChaCha20 where it is not; the session key is wrapped with RSA-4096 (OAEP) and appended to the encrypted file. It is a standard hybrid construction with no exploitable weakness on the ciphertext side.

Encryption modes (critical). Qilin's configuration supports several modes; published analyses document skip-step, percent and fast. In practice this means coverage can differ enormously between cases in the same family:

• under fast / skip-step, only leading and interval blocks of large files are encrypted, leaving substantial original data inside VMDKs and database files;
• percent mode encrypts a configured proportion;
• small files and configuration files are usually encrypted in full.

As a result, "how much is recoverable" is highly case-specific for Qilin and must be established by mapping the encryption layout of the actual files — experience from other cases does not transfer.

Destruction and anti-forensics.

• Deletes volume shadow copies and backup-related services, clears Windows event logs, self-deletes after encryption.
• Stops database and security services, using vulnerable drivers to disable EDR where needed.
• On ESXi/vCenter, deletes VM snapshots before encrypting, cutting off the easiest rollback path.
• Supports encryption of network shares and NAS directories.

Double extortion. Exfiltration precedes encryption, with staged publication on the leak site reinforced by media, customer and regulator pressure.